Vulnerability-Lookup

rustsec-2021-0019

Vulnerability from osv_rustsec

Published

2021-02-04 12:00

Modified

2023-06-13 13:10

Summary

Multiple soundness issues

Details

Calls `std::str::from_utf8_unchecked()` without any checks

The function xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on the raw bytes that were received from the X11 server without any validity checks. The X11 server only prevents interior null bytes, but otherwise allows any X11 client to create an atom for arbitrary bytes.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/96

`xcb::xproto::GetPropertyReply::value()` allows arbitrary return types

The function xcb::xproto::GetPropertyReply::value() returns a slice of type T where T is an unconstrained type parameter. The raw bytes received from the X11 server are interpreted as the requested type.

The users of the xcb crate are advised to only call this function with the intended types. These are u8, u16, and u32.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95

Out of bounds read in `xcb::xproto::change_property()`

xcb::xproto::change_property has (among others) the arguments format: u8 and data: &[T]. The intended use is one of the following cases: - format = 8 and T = u8 - format = 16 and T = u16 - format = 32 and T = u32 However, this constraint is not enforced. For example, it is possible to call the function with format = 32 and T = u8. In this case, a read beyond the end of the data slice is performed and the bytes are sent to the X11 server.

The users of the xcb crate are advised to only call this function with one of the intended argument combinations.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/94

'Safe' wrapper around `std::mem::transmute()`

The function xcb::base::cast_event() takes a reference to a xcb::base::GenericEvent and returns a reference to an arbitrary type, as requested by the caller (or found via type interference). The function is implemented as a direct call to std::mem::transmute(). Since the return type is not constrained, this allows transmution to an incorrect type or a type that is larger than the X11 event that was passed in.

X11 events are mostly always 32 bytes large and this function works as intended.

Users are advised to only cast to the event structs provided by the xcb crate (and hope for the best).

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/78

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption",
          "memory-exposure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "xcb",
        "purl": "pkg:cargo/xcb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2021-26955",
    "CVE-2021-26956",
    "CVE-2021-26957",
    "CVE-2021-26958",
    "GHSA-2xpg-3hx4-fm9r",
    "GHSA-3288-cwgw-ch86",
    "GHSA-3cj3-jrrp-9rxf",
    "GHSA-mp6r-fgw2-rxfx"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "## Calls `std::str::from_utf8_unchecked()` without any checks\n\nThe function `xcb::xproto::GetAtomNameReply::name()` calls\n`std::str::from_utf8_unchecked()` on the raw bytes that were received from the\nX11 server without any validity checks. The X11 server only prevents interior\nnull bytes, but otherwise allows any X11 client to create an atom for arbitrary\nbytes.\n\nThis issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/96\n\n## `xcb::xproto::GetPropertyReply::value()` allows arbitrary return types\n\nThe function `xcb::xproto::GetPropertyReply::value()` returns a slice of type\n`T` where `T` is an unconstrained type parameter. The raw bytes received from\nthe X11 server are interpreted as the requested type.\n\nThe users of the `xcb` crate are advised to only call this function with the\nintended types. These are `u8`, `u16`, and `u32`.\n\nThis issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95\n\n## Out of bounds read in `xcb::xproto::change_property()`\n\n`xcb::xproto::change_property` has (among others) the arguments `format: u8` and\n`data: \u0026[T]`. The intended use is one of the following cases:\n- `format = 8` and `T = u8`\n- `format = 16` and `T = u16`\n- `format = 32` and `T = u32`\nHowever, this constraint is not enforced. For example, it is possible to call\nthe function with `format = 32` and `T = u8`. In this case, a read beyond the\nend of the `data` slice is performed and the bytes are sent to the X11 server.\n\nThe users of the `xcb` crate are advised to only call this function with one of\nthe intended argument combinations.\n\nThis issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/94\n\n## \u0027Safe\u0027 wrapper around `std::mem::transmute()`\n\nThe function `xcb::base::cast_event()` takes a reference to a\n`xcb::base::GenericEvent` and returns a reference to an arbitrary type, as\nrequested by the caller (or found via type interference). The function is\nimplemented as a direct call to `std::mem::transmute()`. Since the return type\nis not constrained, this allows transmution to an incorrect type or a type that\nis larger than the X11 event that was passed in.\n\nX11 events are mostly always 32 bytes large and this function works as intended.\n\nUsers are advised to only cast to the event structs provided by the `xcb` crate\n(and hope for the best).\n\nThis issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/78",
  "id": "RUSTSEC-2021-0019",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2021-02-04T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/xcb"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/RustSec/advisory-db/issues/653"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rust-x-bindings/rust-xcb/issues/78"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rust-x-bindings/rust-xcb/issues/94"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rust-x-bindings/rust-xcb/issues/95"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rust-x-bindings/rust-xcb/issues/96"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Multiple soundness issues"
}

CVE-2021-26955 (GCVE-0-2021-26955)

Vulnerability from cvelistv5 – Published: 2021-02-09 22:07 – Updated: 2024-08-03 20:33

Summary

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://rustsec.org/advisories/RUSTSEC-2021-0019.html

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:41.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-09T22:07:26",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-26955",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-26955",
    "datePublished": "2021-02-09T22:07:26",
    "dateReserved": "2021-02-09T00:00:00",
    "dateUpdated": "2024-08-03T20:33:41.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26957 (GCVE-0-2021-26957)

Vulnerability from cvelistv5 – Published: 2021-02-09 22:07 – Updated: 2024-08-03 20:33

Summary

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://rustsec.org/advisories/RUSTSEC-2021-0019.html

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:41.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-09T22:07:18",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-26957",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-26957",
    "datePublished": "2021-02-09T22:07:18",
    "dateReserved": "2021-02-09T00:00:00",
    "dateUpdated": "2024-08-03T20:33:41.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26958 (GCVE-0-2021-26958)

Vulnerability from cvelistv5 – Published: 2021-02-09 22:07 – Updated: 2024-08-03 20:33

Summary

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://rustsec.org/advisories/RUSTSEC-2021-0019.html

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:41.566Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-09T22:07:10",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-26958",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-26958",
    "datePublished": "2021-02-09T22:07:10",
    "dateReserved": "2021-02-09T00:00:00",
    "dateUpdated": "2024-08-03T20:33:41.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26956 (GCVE-0-2021-26956)

Vulnerability from cvelistv5 – Published: 2021-02-09 22:06 – Updated: 2024-08-03 20:33

Summary

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://rustsec.org/advisories/RUSTSEC-2021-0019.html

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:41.405Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-09T22:06:48",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-26956",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-26956",
    "datePublished": "2021-02-09T22:06:48",
    "dateReserved": "2021-02-09T00:00:00",
    "dateUpdated": "2024-08-03T20:33:41.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-3CJ3-JRRP-9RXF

Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2021-08-19 17:44

Summary

Unchecked Return Value in xcb

Details

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "xcb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-26958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-252"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T17:44:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.",
  "id": "GHSA-3cj3-jrrp-9rxf",
  "modified": "2021-08-19T17:44:11Z",
  "published": "2021-08-25T20:53:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustSec/advisory-db/issues/653"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rtbo/rust-xcb"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unchecked Return Value in xcb"
}

GHSA-3288-CWGW-CH86

Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2021-08-19 17:44

Summary

Unchecked Return Value in xcb

Details

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "xcb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-26955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-252"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T17:44:05Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.",
  "id": "GHSA-3288-cwgw-ch86",
  "modified": "2021-08-19T17:44:05Z",
  "published": "2021-08-25T20:53:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26955"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustSec/advisory-db/issues/653"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rtbo/rust-xcb"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unchecked Return Value in xcb"
}

GHSA-2XPG-3HX4-FM9R

Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2021-08-19 17:44

Summary

Out of bounds read in xcb

Details

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "xcb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-26957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T17:44:08Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.",
  "id": "GHSA-2xpg-3hx4-fm9r",
  "modified": "2021-08-19T17:44:08Z",
  "published": "2021-08-25T20:53:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26957"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustSec/advisory-db/issues/653"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rtbo/rust-xcb"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Out of bounds read in xcb"
}

GHSA-MP6R-FGW2-RXFX

Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2023-06-13 22:28

Summary

Arbitrary return types in xcb

Details

The function xcb::xproto::GetPropertyReply::value() returns a slice of type T where T is an unconstrained type parameter. The raw bytes received from the X11 server are interpreted as the requested type. The users of the xcb crate are advised to only call this function with the intended types. These are u8, u16, and u32.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "xcb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-26956"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-657"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T17:35:46Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "The function xcb::xproto::GetPropertyReply::value() returns a slice of type T where T is an unconstrained type parameter. The raw bytes received from the X11 server are interpreted as the requested type. The users of the xcb crate are advised to only call this function with the intended types. These are u8, u16, and u32.\n\nThis issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95",
  "id": "GHSA-mp6r-fgw2-rxfx",
  "modified": "2023-06-13T22:28:51Z",
  "published": "2021-08-25T20:53:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26956"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustSec/advisory-db/issues/653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-x-bindings/rust-xcb/issues/95"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rtbo/rust-xcb"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arbitrary return types in xcb"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2021-0019

Vulnerability from osv_rustsec

Calls std::str::from_utf8_unchecked() without any checks

xcb::xproto::GetPropertyReply::value() allows arbitrary return types

Out of bounds read in xcb::xproto::change_property()

'Safe' wrapper around std::mem::transmute()

CVE-2021-26955 (GCVE-0-2021-26955)

CVE-2021-26957 (GCVE-0-2021-26957)

CVE-2021-26958 (GCVE-0-2021-26958)

CVE-2021-26956 (GCVE-0-2021-26956)

GHSA-3CJ3-JRRP-9RXF

GHSA-3288-CWGW-CH86

GHSA-2XPG-3HX4-FM9R

GHSA-MP6R-FGW2-RXFX

Tags

Sightings

Nomenclature

Calls `std::str::from_utf8_unchecked()` without any checks

`xcb::xproto::GetPropertyReply::value()` allows arbitrary return types

Out of bounds read in `xcb::xproto::change_property()`

'Safe' wrapper around `std::mem::transmute()`